---
id: 5466
title: "Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/browser-powered-desync-attacks"
published_at: "2025-09-03T07:36:00Z"
tags: ["black-hat", "web-security", "request-smuggling", "desync", "client-side-desync", "pause-based-desync"]
phying_url: "https://phying.com/item/5466"
lang: en
---

# Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling

## Summary

James Kettle turns victims' browsers into desync delivery platforms, exposing single-server sites and internal networks via client-side and pause-based desync against Apache, Varnish and web VPNs.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2025-09-03T07:36:00Z
- **Original:** https://portswigger.net/research/browser-powered-desync-attacks
- **Phying News:** https://phying.com/item/5466